Data Processing Addendum
Effective date: July 18, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement between CelMind Corp., a Delaware corporation ("CelMind"), and the customer ("Customer") governing the Predict.ai services (the "Agreement"). It applies where CelMind processes personal data contained in Customer Content on Customer's behalf.
1. Definitions
"Data Protection Laws" means all laws applicable to the processing of personal data under the Agreement, including the EU GDPR, UK GDPR, Swiss FADP, and the CCPA/CPRA. "Personal data", "controller", "processor", "data subject", and "processing" have the meanings given in the applicable Data Protection Laws.
2. Roles and Scope
Customer is the controller (or a processor acting for a third-party controller) of personal data in Customer Content; CelMind is a processor (or subprocessor). CelMind will process such personal data only on Customer's documented instructions — including as set out in the Agreement, this DPA, and Customer's configuration of the services — unless required by law, in which case CelMind will inform Customer unless legally prohibited. Under the CCPA, CelMind acts as a "service provider", will not sell or share personal information, and will not retain, use, or disclose it other than to provide the services.
3. Details of Processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Predict.ai prediction platform: ingestion, storage, modeling, forecasting, and serving. |
| Duration | The term of the Agreement plus the deletion period below. |
| Nature and purpose | Hosting, computation, model training and inference, analytics, and related support, as instructed by Customer. |
| Categories of data | Determined by Customer; may include identifiers, transaction records, telemetry, and other data Customer uploads as signals or events. |
| Data subjects | Determined by Customer; may include Customer's end users, customers, employees, or other individuals. |
4. Data Residency
CelMind operates the services on multi-region infrastructure. Each workspace is assigned a home region at creation — the region Customer explicitly selects, a region configured for Customer's organization, or, absent either, a region determined automatically from Customer's location (profile country or request geolocation). Customer Content is stored and processed at rest in the workspace's home region. Where the home region is CelMind's EU region — the default for Customers located in the European Union — Customer Content is stored and processed at rest in data centers located within the European Union.
Customer Content is not transferred out of the home region except on Customer's instruction or configuration (including publication of signals to the Signal Marketplace, which subscribers may access from other regions) or where required by law. Regional residency applies to Customer Content; limited account and billing metadata may be processed globally as described in the Privacy Policy. Customer is responsible for verifying that its workspace's assigned region meets its residency requirements and for selecting a region explicitly where required.
5. Security
CelMind implements and maintains appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including encryption in transit and at rest, access controls, network isolation, logging and monitoring, and personnel confidentiality commitments. See Security for the current measures.
6. Subprocessors
Customer generally authorizes CelMind to engage subprocessors to provide the services (e.g., cloud infrastructure, payment, and email providers). CelMind will: (a) maintain a list of subprocessors, available on request at [email protected]; (b) impose data protection obligations on subprocessors no less protective than this DPA; (c) notify Customer of new subprocessors, giving Customer the opportunity to object on reasonable data-protection grounds; and (d) remain liable for its subprocessors' performance.
7. Assistance and Data Subject Requests
Taking into account the nature of the processing, CelMind will assist Customer, by appropriate technical and organizational measures and at Customer's expense where the assistance is material, with: (a) responding to data subject requests (access, rectification, erasure, portability, restriction, objection); (b) security, breach notification, data protection impact assessments, and consultations with supervisory authorities. If CelMind receives a request directly from a data subject relating to Customer Content, it will promptly forward the request to Customer and not respond except as legally required.
8. Personal Data Breach
CelMind will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Content, and will provide information reasonably required for Customer to meet its breach notification obligations, along with reasonable cooperation in remediation.
9. International Transfers
Where processing involves a transfer of personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Module 2: controller-to-processor, or Module 3: processor-to-processor, as applicable), together with the UK International Data Transfer Addendum and Swiss adaptations as required. CelMind will provide executed copies on request.
10. Audits
CelMind will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party audit reports and security certifications. Where Data Protection Laws grant Customer an audit right that cannot be satisfied by such documentation, Customer may conduct an audit no more than once per year, on at least 30 days' notice, during business hours, subject to confidentiality, and without access to other customers' data.
11. Return and Deletion
Upon termination of the Agreement and written request made within 30 days, CelMind will make Customer Content available for export. After that period, CelMind will delete Customer Content within 90 days, except where retention is required by law, in which case the data remains protected under this DPA until deleted.
12. Liability and Order of Precedence
Each party's liability under this DPA is subject to the limitations of liability in the Agreement. In case of conflict between this DPA and the Agreement regarding the processing of personal data, this DPA controls; the Standard Contractual Clauses control over this DPA where they apply.
13. Contact
To execute a signed copy of this DPA or the Standard Contractual Clauses, or for any data protection question, contact [email protected].